Записи OpenHarmony
18 опубликованных записей вендора openharmony.
Профиль для исследователя
- Попали в KEV
- 0 · 0 %
- С эксплойтом
- 0 · 0 %
- Pre-auth RCE
- 0
- С записью об исправлении
- 0 %
- Медиана: публикация → KEV
- Ни одна запись не попала в KEV
Повторяющиеся классы
- CWE-287 Improper Authentication5
- CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')4
- CWE-305 Authentication Bypass by Primary Weakness3
- CWE-20 Improper Input Validation1
- CWE-276 Incorrect Default Permissions1
- CWE-476 NULL Pointer Dereference1
Классы уязвимостей, которые чаще всего встречаются у этого вендора: куда смотреть.
CWEВсе записи
18 записей| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
35Наблюдать | CVE-2022-38700Эксплойта нет | multimedia subsystem has a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.openharmony · openharmony · CWE-305 | Высокая8,8 | — | 0,4 % | 9 сент. 2022 г. |
35Наблюдать | CVE-2022-42463Эксплойта нет | Softbus_server in communication subsystem has a authenication bypass vulnerability in a callback handler function. Attackers can launch attacks on distributed nopenharmony · openharmony · CWE-287 | Высокая8,8 | — | 0,3 % | 14 окт. 2022 г. |
31Наблюдать | CVE-2022-44455Эксплойта нет | The appspawn and nwebspawn services were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation.openharmony · openharmony · CWE-120 | Высокая7,8 | — | 0,2 % | 8 дек. 2022 г. |
31Наблюдать | CVE-2022-42464Эксплойта нет | Kernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device openharmony · openharmony · CWE-276 | Высокая7,8 | — | 0,2 % | 14 окт. 2022 г. |
31Наблюдать | CVE-2022-42488Эксплойта нет | Startup subsystem missed permission validation in param service. An malicious application installed on the device could elevate its privileges to the root user,openharmony · openharmony · CWE-287 | Высокая7,8 | — | 0,2 % | 14 окт. 2022 г. |
31Наблюдать | CVE-2022-43662Эксплойта нет | Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysTimerGettime.openharmony · openharmony · CWE-120 | Высокая7,8 | — | 0,2 % | 8 янв. 2023 г. |
31Наблюдать | CVE-2022-45126Эксплойта нет | Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGettime.openharmony · openharmony · CWE-120 | Высокая7,8 | — | 0,2 % | 8 янв. 2023 г. |
30Наблюдать | CVE-2022-43495Эксплойта нет | An abnormal packet recieved when distributedhardware_device_manager joining a network could cause a device reboot.openharmony · openharmony · CWE-476 | Высокая7,5 | — | 0,7 % | 3 нояб. 2022 г. |
29Наблюдать | CVE-2022-36423Эксплойта нет | Incorrect configuration of the cJSON library lead a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network deopenharmony · openharmony · CWE-16 | Высокая7,4 | — | 0,3 % | 9 сент. 2022 г. |
26Наблюдать | CVE-2022-43451Эксплойта нет | Multiple path traversal in appspawn and nwebspawn services.openharmony · openharmony · CWE-287 | Средняя6,5 | — | 0,2 % | 3 нояб. 2022 г. |
22Наблюдать | CVE-2022-38081Эксплойта нет | Tokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weaopenharmony · openharmony · CWE-305 | Средняя5,5 | — | 0,2 % | 9 сент. 2022 г. |
22Наблюдать | CVE-2022-38064Эксплойта нет | windowmanager in window subsystem has a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.openharmony · openharmony · CWE-305 | Средняя5,5 | — | 0,2 % | 9 сент. 2022 г. |
22Наблюдать | CVE-2022-45118Эксплойта нет | Telephony in communication subsystem sends public events with personal data, but the permission is not set.openharmony · openharmony · CWE-287 | Средняя5,5 | — | 0,2 % | 8 дек. 2022 г. |
22Наблюдать | CVE-2022-43449Эксплойта нет | Arbitrary file read via download_server.openharmony · openharmony · CWE-20 | Средняя5,5 | — | 0,2 % | 3 нояб. 2022 г. |
21Наблюдать | CVE-2022-45877Эксплойта нет | PIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks.openharmony · openharmony · CWE-287 | Средняя5,3 | — | 0,2 % | 8 дек. 2022 г. |
17Наблюдать | CVE-2022-41686Эксплойта нет | Out-of-bound memory read and write in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the openharmony · openharmony · CWE-787 | Средняя4,4 | — | 0,3 % | 14 окт. 2022 г. |
13Наблюдать | CVE-2022-38701Эксплойта нет | IPC in communication subsystem has a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.openharmony · openharmony · CWE-122 | Низкая3,3 | — | 0,2 % | 9 сент. 2022 г. |
13Наблюдать | CVE-2022-41802Эксплойта нет | Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres.openharmony · openharmony · CWE-120 | Низкая3,3 | — | 0,2 % | 8 дек. 2022 г. |
- CVE-2022-3870035Наблюдать
multimedia subsystem has a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.
ВысокаяCVSS 8,8Эксплойта нетEPSS 0 %openharmony · openharmony9 сент. 2022 г.
- CVE-2022-4246335Наблюдать
Softbus_server in communication subsystem has a authenication bypass vulnerability in a callback handler function. Attackers can launch attacks on distributed n
ВысокаяCVSS 8,8Эксплойта нетEPSS 0 %openharmony · openharmony14 окт. 2022 г.
- CVE-2022-4445531Наблюдать
The appspawn and nwebspawn services were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation.
ВысокаяCVSS 7,8Эксплойта нетEPSS 0 %openharmony · openharmony8 дек. 2022 г.
- CVE-2022-4246431Наблюдать
Kernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device
ВысокаяCVSS 7,8Эксплойта нетEPSS 0 %openharmony · openharmony14 окт. 2022 г.
- CVE-2022-4248831Наблюдать
Startup subsystem missed permission validation in param service. An malicious application installed on the device could elevate its privileges to the root user,
ВысокаяCVSS 7,8Эксплойта нетEPSS 0 %openharmony · openharmony14 окт. 2022 г.
- CVE-2022-4366231Наблюдать
Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysTimerGettime.
ВысокаяCVSS 7,8Эксплойта нетEPSS 0 %openharmony · openharmony8 янв. 2023 г.
- CVE-2022-4512631Наблюдать
Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGettime.
ВысокаяCVSS 7,8Эксплойта нетEPSS 0 %openharmony · openharmony8 янв. 2023 г.
- CVE-2022-4349530Наблюдать
An abnormal packet recieved when distributedhardware_device_manager joining a network could cause a device reboot.
ВысокаяCVSS 7,5Эксплойта нетEPSS 1 %openharmony · openharmony3 нояб. 2022 г.
- CVE-2022-3642329Наблюдать
Incorrect configuration of the cJSON library lead a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network de
ВысокаяCVSS 7,4Эксплойта нетEPSS 0 %openharmony · openharmony9 сент. 2022 г.
- CVE-2022-4345126Наблюдать
Multiple path traversal in appspawn and nwebspawn services.
СредняяCVSS 6,5Эксплойта нетEPSS 0 %openharmony · openharmony3 нояб. 2022 г.
- CVE-2022-3808122Наблюдать
Tokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this wea
СредняяCVSS 5,5Эксплойта нетEPSS 0 %openharmony · openharmony9 сент. 2022 г.
- CVE-2022-3806422Наблюдать
windowmanager in window subsystem has a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.
СредняяCVSS 5,5Эксплойта нетEPSS 0 %openharmony · openharmony9 сент. 2022 г.
- CVE-2022-4511822Наблюдать
Telephony in communication subsystem sends public events with personal data, but the permission is not set.
СредняяCVSS 5,5Эксплойта нетEPSS 0 %openharmony · openharmony8 дек. 2022 г.
- CVE-2022-4344922Наблюдать
Arbitrary file read via download_server.
СредняяCVSS 5,5Эксплойта нетEPSS 0 %openharmony · openharmony3 нояб. 2022 г.
- CVE-2022-4587721Наблюдать
PIN code is transmitted to the peer device in plain text during cross-device authentication, which reduces the difficulty of man-in-the-middle attacks.
СредняяCVSS 5,3Эксплойта нетEPSS 0 %openharmony · openharmony8 дек. 2022 г.
- CVE-2022-4168617Наблюдать
Out-of-bound memory read and write in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the
СредняяCVSS 4,4Эксплойта нетEPSS 0 %openharmony · openharmony14 окт. 2022 г.
- CVE-2022-3870113Наблюдать
IPC in communication subsystem has a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.
НизкаяCVSS 3,3Эксплойта нетEPSS 0 %openharmony · openharmony9 сент. 2022 г.
- CVE-2022-4180213Наблюдать
Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres.
НизкаяCVSS 3,3Эксплойта нетEPSS 0 %openharmony · openharmony8 дек. 2022 г.